What actually gets fingerprinted
Every kernel anti-cheat logs some subset of these on install and on every launch:
- SMBIOS UUID and system serial (motherboard-level)
- Motherboard serial number and manufacturer
- CPU brand + serial (older CPUs)
- Disk serial numbers — ALL physical disks, not just C:. This is where cheap spoofers fail.
- MAC addresses of ALL network adapters (Ethernet, Wi-Fi, Bluetooth, virtual)
- TPM 2.0 endorsement key — unique per motherboard, cryptographically signed
- GPU device ID + PCI location
- EDID hash from connected monitors
- Windows install ID and machine SID
- Various registry keys under HKLM\SYSTEM\HardwareConfig
A HWID ban is a hash of most or all of the above. Change one field and the hash misses; change none and it hits.
Why 'permanent' actually means permanent
Anti-cheats don't store the ban in a Windows-accessible way. It lives on the publisher's servers, keyed to the SMBIOS + TPM signature. Reinstalling Windows doesn't help. Zeroing the SSD doesn't help. Only physically replacing the motherboard (or spoofing every logged identifier) removes the ban.
BattlEye and EAC-EOS run these bans forever. Ricochet is more forgiving — they've been known to lift older HWID bans after ~12 months if the account had no other flags. Vanguard is the strictest — TPM-based fingerprinting means motherboard swap is genuinely required.
What a real spoofer does
A proper HWID spoofer is a kernel driver that intercepts every identifier read the anti-cheat performs and returns a fake, consistent value. The important word is CONSISTENT — random values on every launch is a bigger flag than the ban itself.
Minimum feature set: - SMBIOS spoof (BIOS-level, not just registry) - Disk serial spoof for every physical disk (SATA + NVMe) - MAC spoof for every adapter (persistent across reboots) - TPM shim (fake endorsement key that survives verification) - GPU device ID spoof - Registry cleanup for cached hardware IDs - Volume serials + machine SID rotation
Cheap spoofers (~$5/month Discord gigs) usually only do SMBIOS + MAC. They fail against EAC and BattlEye instantly because disk serial ≠ spoofed.
Cleaner: what runs alongside the spoofer
The spoofer changes what the AC reads at query time. A cleaner deletes the persistent traces the AC left behind on your last install:
- Trace files under C:\ProgramData\{BattlEye,EasyAntiCheat}\
- Kernel driver residue in \Windows\System32\drivers\
- Registry keys under HKLM\SOFTWARE\Wow6432Node\{BE,EAC}
- Event log fragments
- Prefetch and Amcache entries
Always run cleaner → spoofer → game launch, in that order. Reverse the order and the AC sees the old identifiers in traces even though the live query returns spoofed.
The actual workflow
1. Get banned (or just start fresh). 2. Uninstall the game. 3. Run cleaner as admin. Reboot. 4. Install spoofer. Reboot into spoofed state. 5. Verify HWID has changed (spoofer usually ships with a check tool showing before/after). 6. Install the game fresh. 7. Log in with a NEW account (never the banned one — that account is flagged regardless of HWID).
Repeat steps 3-7 every time you get banned. Most rage users spoof every 2-4 weeks even without bans, as preventative rotation.
Alternative: VM with hardware passthrough
If you know KVM/QEMU: a Windows guest with real GPU passthrough + a spoofed set of USB peripherals gives you a machine that anti-cheats see as a completely separate PC. Nuke the VM disk after a ban, spin up a new one from a snapshot, done.
Drawbacks: EAC and Vanguard specifically detect hypervisor presence via CPUID leaves. Requires custom hypervisor patches (KVM 'stealth' patches) to hide the VM. Not for beginners.